Threat database

A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-86298 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /delete_subject.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. This vulnerability has a medium severity with a CVSS score of 6.9. Exploit code has been publicly released, increasing the risk of attacks. No official patch or remediation guidance is currently available.

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

SourceCodester Simple Traffic Offense System version 1.0 contains a vulnerability in the delete-user.php file of the Deletion Endpoint component. This flaw allows remote attackers to bypass authentication by manipulating the ID argument, potentially enabling unauthorized deletion of user data. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code for this vulnerability has been published, but there are no known exploits actively used in the wild. No official patch or remediation guidance is currently available.

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-86290 is a medium severity SQL injection vulnerability in SourceCodester Online Voting System version 1.0. It affects the /voting/ajax.php?action=save_category endpoint by allowing remote attackers to manipulate the Category parameter to execute SQL injection. The vulnerability is publicly known with exploit code available, but no official patch or remediation has been confirmed.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-86280 is a medium-severity vulnerability in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. It involves cleartext storage of sensitive information in the file cict_portal.sql. The vulnerability can be exploited remotely without authentication. Public exploit code is available. No patch or remediation information is currently provided.

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file auth_process.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-86278 is a cross-site scripting (XSS) vulnerability in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The vulnerability exists in an unspecified function within the manage_subjects.php file, where manipulation of the msg, title, or content parameters can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. An exploit has been publicly disclosed.

CVE-2026-86277 is an authorization bypass vulnerability in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The flaw exists in the delete_exam.php file where manipulation of the ID argument allows unauthorized actions. The vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been published and may be used.

CVE-2026-86275 is a medium-severity vulnerability in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. It involves improper privilege management in the register function of auth.php, where manipulation of the role argument can lead to unauthorized privilege escalation. The vulnerability is remotely exploitable without authentication and has a publicly available exploit.

CVE-2026-86225 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the mysqli_query function within the /admin/modal_add_room.php file, where the room_name parameter is improperly sanitized. This allows remote attackers to inject SQL commands. The vulnerability has a medium severity with a CVSS score of 6.9. Exploit code is publicly available, but no known active exploitation has been reported. No official patch or remediation guidance is currently provided.

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-86223 is a medium severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. It affects the mysqli_query function in the /admin/modal_add_coursea.php file, where manipulation of the 'course' argument allows remote attackers to perform SQL injection. The vulnerability is remotely exploitable and an exploit has been publicly disclosed.

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.